[AusNOG] port 0 probes

[Andree Toonk]

Hi Alex,

Not sure where you're seeing this, but if it's in netflow: most routers
typically mark non-initial fragments as port 0.

So if you see udp port 0 ports in netflow it's most likely udp
fragments. Typically you'll see the same increase in 1500 byte packets
(the initial packet).

Cheers,
 Andree


.-- My secret spy satellite informs me that at 2014-10-06 5:34 PM  Alex
Samad - Yieldbroker wrote:
> Hi
> 
>  
> 
> I am seeing a marked increase src port 0 and dst port 0 packets.  Anyone
> else seeing this.
> 
>  
> 
> I presume this is some sort of probe.
> 
>  
> 
> Is there a legal reason to use port 0 ?
> 
>  
> 
> A
> 
> _______________________________________________
> AusNOG mailing list
> AusNOG at lists.ausnog.net
> http://lists.ausnog.net/mailman/listinfo/ausnog